You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2021/04/16 22:00:20 UTC
svn commit: r1888834 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Apr 16 22:00:20 2021
New Revision: 1888834
URL: http://svn.apache.org/viewvc?rev=1888834&view=rev
Log:
Add some rules for eval
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1888834&r1=1888833&r2=1888834&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Apr 16 22:00:20 2021
@@ -3175,6 +3175,7 @@ tflags EBAY_IMG_NOT_RCVD_EBAY p
header __HDR_RCVD_AMAZON X-Spam-Relays-External =~ /\srdns=\S+\.amazon(?:ses)?\.com\s/
uri __URI_IMG_AMAZON m,://[^/?]+\.(?:ssl-)?images-amazon\.com/,i
+header __FROM_NAME_AMAZONCOM From:name =~ /\bamazon\.com\b/i
# price alert site that leverages Amazon, avoid FPs
header __HDR_RCVD_KEEPA X-Spam-Relays-External =~ /\srdns=\S+\.keepa\.com\s/
@@ -3879,6 +3880,8 @@ tflags ADULT_DATING_COMPANY p
body CHINA_MANUFACTURER /\bWe are China located manufacture/i
score CHINA_MANUFACTURER 2.500 # limit
+meta POSSIBLE_AMAZON_PHISH_01 (__FROM_NAME_AMAZONCOM && NAME_EMAIL_DIFF)
+meta POSSIBLE_AMAZON_PHISH_02 (__FROM_NAME_AMAZONCOM && !__HDR_RCVD_AMAZON)